GHSA-75hq-h6g9-h4q5

First published: Tue Apr 02 2024(Updated: )

### Impact The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. The panic in question is caused when a WebAssembly module issues a `table.*` instruction which uses a dropped element segment with a table that also has an `externref` type. This causes Wasmtime to erroneously use an empty function segment instead of an empty externref segment to perform this operation. This mismatch in types causes a panic in Wasmtime when it's asserted that an externref table is only viewed as externrefs. This regression was introduced during the development of the 19.0.0 release and only affects the 19.0.0 release. This panic requires the `reference-types` WebAssembly feature to be enabled, and it is enabled by default. Toolchains are not known to generate this pattern by default so it's likely a module would need to be specifically crafted to trigger this panic. A panic in a host runtime represents a possible denial-of-service in some scenarios. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic. ### Patches Wasmtime 19.0.1 has been released to fix this problem. Users of 19.0.0 should upgrade to 19.0.1. All other versions of Wasmtime are not affected by this issue. ### Workarounds If upgrading is not possible it's recommended to use `config.reference_types(false)`. That will disable these modules at validation-time which prevents the possibility of a panic at runtime. If reference-types are required, however, then there is no other workaround at this time other than upgrading. ### References * [Original bug report](https://github.com/bytecodealliance/wasmtime/issues/8281) * [PR to fix the bug](https://github.com/bytecodealliance/wasmtime/pull/8283) * [PR that introduced the bug](https://github.com/bytecodealliance/wasmtime/pull/8018)

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/weakness
• agent/softwarecombine
• agent/description
• agent/type
• agent/event
• agent/first-publish-date
• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-75hq-h6g9-h4q5
• alias/CVE-2024-30266
• agent/software-canonical-lookup
• agent/references
• agent/last-modified-date
• agent/tags
• collector/github-advisory
• package-manager/rust